api: forbid booking of recurring event (#57523)

chrono/api/views.py

@@ -625,6 +625,11 @@ def get_events_from_slots(slots, request, agenda, payload):
                     _('event %s is already booked by user') % event.slug,
                     err_class='event is already booked by user',
                 )
+        if event.recurrence_days:
+            raise APIError(
+                _('event %s is recurrent, direct booking is forbidden') % event.slug,
+                err_class='event is recurrent',
+            )
 
     if slots and not events.exists():
         raise APIError(

tests/api/test_fillslot.py

@@ -203,22 +203,25 @@ def test_booking_api_exclude_slots(app, user):
         slug='recurrent',
         start_datetime=start_datetime,
         recurrence_days=[start_datetime.weekday()],
-        places=2,
+        places=3,
         agenda=agenda,
     )
     first_recurrence = event.get_or_create_event_recurrence(event.start_datetime)
     Booking.objects.create(event=first_recurrence, user_external_id='42')
     resp = app.post(
-        '/api/agenda/%s/fillslot/%s/' % (agenda.slug, event.slug), params={'user_external_id': '42'}
+        '/api/agenda/%s/fillslot/%s/' % (agenda.slug, first_recurrence.slug),
+        params={'user_external_id': '42'},
     )
     assert resp.json['err'] == 0
     resp = app.post(
-        '/api/agenda/%s/fillslot/%s/' % (agenda.slug, event.slug),
+        '/api/agenda/%s/fillslot/%s/' % (agenda.slug, first_recurrence.slug),
         params={'user_external_id': '42', 'exclude_user': True},
     )
     assert resp.json['err'] == 1
     assert resp.json['err_class'] == 'event is already booked by user'
-    resp = app.post('/api/agenda/%s/fillslot/%s/' % (agenda.slug, event.slug), params={'exclude_user': True})
+    resp = app.post(
+        '/api/agenda/%s/fillslot/%s/' % (agenda.slug, first_recurrence.slug), params={'exclude_user': True}
+    )
     assert resp.json['err'] == 0
 
 
@@ -2541,3 +2544,18 @@ def test_url_translation(app, some_data, user):
     assert booking.backoffice_url == 'publik://default/backoffice/foo/bar'
     assert booking.cancel_callback_url == 'publik://default/foo/bar/jump'
     assert booking.form_url == 'publik://default/foo/bar'
+
+
+def test_fillslot_recurring_event_booking_forbidden(app, user):
+    agenda = Agenda.objects.create(label='Foo bar', kind='events')
+    event = Event.objects.create(
+        label='Event',
+        start_datetime=now() + datetime.timedelta(days=7),
+        recurrence_days=[now().weekday()],
+        places=2,
+        agenda=agenda,
+    )
+    app.authorization = ('Basic', ('john.doe', 'password'))
+    resp = app.post('/api/agenda/%s/fillslot/%s/' % (agenda.slug, event.slug))
+    assert resp.json['err'] == 1
+    assert resp.json['err_class'] == 'event is recurrent'